ace-assign 0.70.0 → 0.73.0

data/lib/ace/assign/authority/task_context_entry.rb

@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-module Ace
-  module Assign
-    module Authority
-      # Structural admission of source-owned pins. Artifact authentication belongs
-      # to the selected entry owner; these references are never an execution grant.
-      module TaskContextEntry
-        LIMITS = {"manifest" => 65_536, "wrapper" => 33_554_432}.freeze
-
-        def self.validate!(value)
-          unless value.is_a?(Hash) && value.keys.sort == LIMITS.keys.sort
-            raise ArgumentError, "task context entry fields differ"
-          end
-          LIMITS.each do |key, limit|
-            reference = value[key]
-            unless reference.is_a?(Hash) && reference.keys.sort == %w[bytes path sha256] &&
-                reference["bytes"].is_a?(Integer) && reference["bytes"].between?(1, limit) &&
-                reference["sha256"].is_a?(String) && reference["sha256"].match?(/\A[0-9a-f]{64}\z/) &&
-                reference["path"].is_a?(String) && reference["path"].encoding == Encoding::UTF_8 &&
-                reference["path"].valid_encoding? && reference["path"].bytesize.between?(2, 4096) &&
-                !reference["path"].include?("\0") && reference["path"].start_with?("/") &&
-                File.expand_path(reference["path"]) == reference["path"]
-              raise ArgumentError, "task context entry reference differs"
-            end
-          end
-          value
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/authority/transfer_codec.rb

@@ -1,187 +0,0 @@
-# frozen_string_literal: true
-
-require "digest"
-require "tempfile"
-require "timeout"
-require "ace/runtime/molecules/protected_socket"
-require_relative "private_directory"
-
-module Ace
-  module Assign
-    module Authority
-      # Binary framing after the existing authenticated control header. The
-      # Server selects purpose from a source handler's fixed operation table,
-      # admits a transfer slot before calling, and holds no journal lock here.
-      class TransferCodec
-        LIMITS = {prompt_text: [16_384, 1, 16_384], scope_boundary_observation: [65_536, 1, 65_536], candidate: [64 * 1024 * 1024, 1, 64 * 1024 * 1024],
-                  artifacts: [256 * 1024, 16, 64 * 1024],
-                  receipt_artifacts: [272 * 1024, 17, 64 * 1024],
-                  service_input: [64 * 1024, 1, 64 * 1024], assignment_snapshot: [64 * 1024 * 1024, 1, 64 * 1024 * 1024]}.freeze
-        SHA256 = /\A[0-9a-f]{64}\z/
-
-        class Input
-          def initialize(file, descriptor)
-            @file, @descriptor = file, descriptor
-          end
-
-          def bytes(index: 0)
-            unless index.is_a?(Integer) && index.between?(0, count - 1)
-              raise ArgumentError, "Invalid transferred part index"
-            end
-            part = @descriptor.fetch("parts").fetch(index)
-            offset = @descriptor.fetch("parts").take(index).sum { |entry| entry.fetch("bytes") }
-            @file.seek(offset)
-            bytes = (@file.read(part.fetch("bytes")) || "").b
-            unless bytes.bytesize == part["bytes"] && Digest::SHA256.hexdigest(bytes) == part["sha256"]
-              raise AttemptErrors::ReceiptRejected, "Transferred bytes no longer match accepted binding"
-            end
-            bytes
-          end
-
-          def count
-            @descriptor.fetch("parts").length
-          end
-        end
-
-        def initialize(root: nil)
-          @root = root && PrivateDirectory.verify!(root)
-        end
-
-        # Upload write-EOF is required before invoking the mutation consumer.
-        # Persistent launch prompt streams use their fixed framed entry point below.
-        def receive(socket, descriptor:, purpose:, deadline:)
-          receive_parts(socket, descriptor: descriptor, purpose: purpose, deadline: deadline, eof: true) { |input| yield input }
-        end
-
-        # Fixed authenticated launch_control stream only. A declared exact
-        # prompt body is followed by the next bounded control frame; unlike
-        # public uploads, this private duplex connection remains writable.
-        def receive_launch_prompt(socket, descriptor:, transfer_id:, deadline:)
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          marker = launch_prompt_marker(transfer_id)
-          receive_parts(socket, descriptor: descriptor, purpose: :prompt_text, deadline: deadline, eof: false) do |input|
-            boundary = Ace::Runtime::Molecules::ProtectedSocket.read(socket, deadline: deadline, limit: 16_384, with_size: true)
-            unless boundary.fetch(:data) == marker && boundary.fetch(:bytesize) == (JSON.generate(marker) + "\n").bytesize
-              reject!("Private prompt boundary differs")
-            end
-            yield input
-          end
-        end
-
-        def send_launch_prompt(socket, bytes:, descriptor:, transfer_id:, deadline:)
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          marker = launch_prompt_marker(transfer_id)
-          send(socket, parts: [bytes], descriptor: descriptor, purpose: :prompt_text, deadline: deadline)
-          Ace::Runtime::Molecules::ProtectedSocket.write(socket, marker, deadline: deadline, limit: 16_384)
-        end
-
-        def launch_prompt_marker(transfer_id)
-          unless transfer_id.is_a?(String) && transfer_id.match?(/\A[0-9a-f]{32}\z/)
-            raise ArgumentError, "invalid private prompt transfer identity"
-          end
-          {"type" => "launch_prompt_end", "transfer_id" => transfer_id}
-        end
-        private :launch_prompt_marker
-
-        def receive_parts(socket, descriptor:, purpose:, deadline:, eof:)
-          validate!(descriptor, purpose)
-          descriptor = descriptor.merge("parts" => descriptor.fetch("parts").map { |part| part.dup.freeze }.freeze).freeze
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          raise ArgumentError, "receive requires protected source scratch" unless @root
-          PrivateDirectory.verify!(@root)
-          Tempfile.create(["transfer-", ".bytes"], @root, binmode: true) do |file|
-            digest = Digest::SHA256.new
-            descriptor.fetch("parts").each do |part|
-              part_digest = Digest::SHA256.new
-              remaining = part.fetch("bytes")
-              while remaining.positive?
-                chunk = read(socket, [remaining, 65_536].min, deadline)
-                reject!("Transferred bytes ended early") if chunk.nil?
-                file.write(chunk)
-                digest.update(chunk)
-                part_digest.update(chunk)
-                remaining -= chunk.bytesize
-              end
-              reject!("Transferred part digest differs") unless part_digest.hexdigest == part["sha256"]
-            end
-            reject!("Transferred aggregate digest differs") unless digest.hexdigest == descriptor["sha256"]
-            reject!("Transferred bytes exceed declared size") if eof && !read(socket, 1, deadline).nil?
-            file.flush
-            file.rewind
-            yield Input.new(file, descriptor)
-          end
-        end
-        private :receive_parts
-
-        def descriptor(parts, purpose:)
-          reject!("Invalid transfer parts") unless parts.is_a?(Array) && parts.all? { |part| part.is_a?(String) }
-          digest = Digest::SHA256.new
-          parts.each { |part| digest.update(part.b) }
-          result = {"version" => 1, "bytes" => parts.sum(&:bytesize), "sha256" => digest.hexdigest,
-                    "parts" => parts.map { |part| {"bytes" => part.bytesize, "sha256" => Digest::SHA256.hexdigest(part.b)} }}
-          validate!(result, purpose)
-          result
-        end
-
-        # The caller writes the bounded JSON descriptor first, then these raw
-        # bytes. Both directions share the Server's original monotonic deadline.
-        def send(socket, parts:, descriptor:, purpose:, deadline:)
-          expected = self.descriptor(parts, purpose: purpose)
-          reject!("Export descriptor differs from bytes") unless expected == descriptor
-          deadline = [deadline, Process.clock_gettime(Process::CLOCK_MONOTONIC) + 30].min
-          parts.each do |part|
-            offset = 0
-            while offset < part.bytesize
-              wait(socket, deadline, write: true)
-              written = socket.write_nonblock(part.byteslice(offset, [65_536, part.bytesize - offset].min), exception: false)
-              offset += written unless written == :wait_writable
-            end
-          end
-        end
-
-        def validate!(descriptor, purpose)
-          total, count, each = LIMITS.fetch(purpose) { reject!("Unknown source transfer purpose") }
-          unless descriptor.is_a?(Hash) && descriptor.keys.sort == %w[bytes parts sha256 version] &&
-              descriptor["version"] == 1 && descriptor["bytes"].is_a?(Integer) &&
-              descriptor["bytes"].between?(0, total) && descriptor["sha256"].is_a?(String) && descriptor["sha256"].match?(SHA256) &&
-              descriptor["parts"].is_a?(Array) && descriptor["parts"].length.between?(1, count) &&
-              descriptor["parts"].all? { |part| part.is_a?(Hash) && part.keys.sort == %w[bytes sha256] &&
-                part["bytes"].is_a?(Integer) && part["bytes"].between?(0, each) &&
-                part["sha256"].is_a?(String) && part["sha256"].match?(SHA256) } &&
-              descriptor["bytes"] == descriptor["parts"].sum { |part| part["bytes"] } &&
-              (!%i[candidate service_input prompt_text assignment_snapshot].include?(purpose) || descriptor["bytes"].positive?)
-            reject!("Invalid or oversized transfer descriptor")
-          end
-          if purpose == :receipt_artifacts
-            receipt, *evidence = descriptor.fetch("parts")
-            unless receipt.fetch("bytes").between?(1, 16 * 1024) && evidence.sum { |part| part.fetch("bytes") } <= 256 * 1024
-              reject!("Receipt or evidence exceeds its fixed transfer limit")
-            end
-          end
-          true
-        end
-
-        private
-
-        def read(socket, count, deadline)
-          loop do
-            wait(socket, deadline)
-            bytes = socket.read_nonblock(count, exception: false)
-            return bytes unless bytes == :wait_readable
-          end
-        end
-
-        def wait(socket, deadline, write: false)
-          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          raise Timeout::Error, "Transfer deadline exceeded" unless remaining.positive?
-          ready = IO.select(write ? nil : [socket], write ? [socket] : nil, nil, remaining)
-          raise Timeout::Error, "Transfer deadline exceeded" unless ready
-        end
-
-        def reject!(message)
-          raise AttemptErrors::MalformedTransfer, message
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/base.rb

@@ -1,84 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "../../../authority/protected_assignment_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        # Public `ace-assign attempt` command namespace (interface contract:
-        # start, status, finish, reconcile).
-        module Attempt
-          # Shared coordinator construction, option validation, and JSON output.
-          module Base
-            private
-
-            def protected_context(options)
-              keys = %i[mapping assignment result head candidate_generation mutation expected_generation inbox_context registration signature]
-              keys.each do |key|
-                if options.key?(key) && options[key].to_s.strip.empty?
-                  raise Ace::Support::Cli::Error, "Empty protected --#{key.to_s.tr('_', '-')} selector"
-                end
-              end
-              context = @protected_assignment_context ||= Ace::Assign::Authority::ProtectedAssignmentContext.load
-              selected = keys.any? do |key|
-                options.key?(key)
-              end
-              context if context.protected_participant? || selected || context.mapping_hint?
-            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-              protected_transport_unavailable!
-            end
-
-            def protected_attempt_request(context, options, usage)
-              params = {"assignment_id" => require_option(options, :assignment, usage),
-                "attempt_id" => require_option(options, :attempt, usage),
-                "expected_generation" => integer_option(options, :expected_generation, usage)}
-              context.verify_attempt_hints!(assignment_id: params.fetch("assignment_id"), attempt_id: params.fetch("attempt_id"))
-              [context.client(options: options), params, require_option(options, :mutation, usage)]
-            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-              protected_transport_unavailable!
-            end
-
-            def protected_call(client, operation, params, mutation)
-              client.call(operation, params, mutation_id: mutation, timeout: 30).data
-            rescue SecurityError, Ace::Runtime::RuntimeUnavailableError
-              protected_transport_unavailable!
-            end
-
-            def protected_transport_unavailable!
-              raise AttemptErrors::EvidenceUnavailable, "Protected authority outcome unavailable; retain original selectors and mutation for reconciliation"
-            end
-
-            def integer_option(options, key, usage, positive: false)
-              value = options[key]
-              unless value.is_a?(Integer) || (value.is_a?(String) && value.match?(/\A(?:0|[1-9][0-9]*)\z/))
-                raise Ace::Support::Cli::Error, "--#{key.to_s.tr('_', '-')} requires an exact integer: #{usage}"
-              end
-              number = value.is_a?(Integer) ? value : Integer(value, 10)
-              unless positive ? number.positive? : number >= 0
-                raise Ace::Support::Cli::Error, "--#{key.to_s.tr('_', '-')} is out of range"
-              end
-              number
-            end
-
-            def build_coordinator
-              Organisms::AttemptCoordinator.new
-            end
-
-            def require_option(options, key, usage)
-              value = options[key].to_s.strip
-              raise Ace::Support::Cli::Error, "Missing --#{key}: usage: ace-assign attempt #{usage}" if value.empty?
-
-              value
-            end
-
-            def emit_json(payload)
-              puts JSON.generate(payload)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/evidence.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-require_relative "base"
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          class Evidence < Ace::Support::Cli::Command
-            include Attempt::Base
-            desc "Read coordinator-accepted live execution or historical execution authority"
-            option :attempt, required: true, desc: "Accepted execution attempt ID"
-            option :receipt_digest, required: true, desc: "Accepted receipt digest"
-            option :kind, default: "check", desc: "Evidence purpose: check, review-collection or review-approval"
-            option :check_name, default: "tests", desc: "Required check name (tests binds operation test)"
-            option :historical_head, desc: "Exact recorded head for historical authority only (never current-head evidence)"
-            option :format, default: "json", desc: "JSON evidence projection"
-
-            def call(**options)
-              raise Ace::Support::Cli::Error, "evidence supports --format json" unless options[:format] == "json"
-              emit_json(build_coordinator.evidence(attempt_id: options[:attempt], receipt_digest: options[:receipt_digest],
-                kind: options[:kind], check_name: options[:check_name], historical_head: options[:historical_head]))
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/finish.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Protected completion selects an already submitted canonical result.
-          # Ordinary local completion accepts its structured receipt file.
-          class Finish < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Finish a protected canonical result or an ordinary local receipt"
-
-            option :attempt, desc: "Attempt ID"
-            option :mapping, desc: "Exact installed protected mapping ID"
-            option :assignment, desc: "Exact protected assignment ID"
-            option :mutation, desc: "Stable original authority mutation ID"
-            option :expected_generation, desc: "Original authority mutation generation"
-            option :receipt, desc: "Path to the ordinary local receipt JSON file"
-            option :result, desc: "Already submitted canonical protected result ID"
-            option :head, desc: "Exact canonical candidate head"
-            option :candidate_generation, desc: "Original canonical candidate generation"
-
-            def call(**options)
-              if (context = protected_context(options))
-                raise Ace::Support::Cli::Error, "Protected finish forbids --receipt" unless options[:receipt].to_s.empty?
-                usage = "finish --mapping MAP --assignment ID --attempt ID --result ID --head SHA --candidate-generation N --mutation ID --expected-generation N"
-                client, params, mutation = protected_attempt_request(context, options, usage)
-                params.merge!("result_id" => require_option(options, :result, usage), "head" => require_option(options, :head, usage),
-                  "candidate_generation" => integer_option(options, :candidate_generation, usage, positive: true))
-                emit_json(protected_call(client, "finish", params, mutation))
-                return
-              end
-              attempt_id = require_option(options, :attempt, "finish --attempt ID --receipt FILE")
-              receipt = require_option(options, :receipt, "finish --attempt ID --receipt FILE")
-
-              result = build_coordinator.finish(attempt_id: attempt_id, receipt_path: receipt)
-
-              emit_json(result.projection)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/reconcile.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Classify interruptions and resolve uncertainty against verified,
-          # boundary-attributed receipts. Never replays external effects.
-          class Reconcile < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Reconcile an interrupted or uncertain attempt"
-
-            option :attempt, desc: "Attempt ID"
-            option :mapping, desc: "Exact installed protected mapping ID"
-            option :assignment, desc: "Exact protected assignment ID"
-            option :mutation, desc: "Stable original authority mutation ID"
-            option :expected_generation, desc: "Original authority mutation generation"
-            option :receipt, desc: "Path to the receipt JSON file (required to resolve uncertainty)"
-
-            def call(**options)
-              if (context = protected_context(options))
-                raise Ace::Support::Cli::Error, "Protected recovery forbids --receipt" unless options[:receipt].to_s.empty?
-                usage = "reconcile --mapping MAP --assignment ID --attempt ID --mutation ID --expected-generation N"
-                client, params, mutation = protected_attempt_request(context, options, usage)
-                emit_json(protected_call(client, "recover", params, mutation))
-                return
-              end
-              attempt_id = require_option(options, :attempt, "reconcile --attempt ID [--receipt FILE]")
-              receipt = options[:receipt].to_s.strip
-
-              result = build_coordinator.reconcile(
-                attempt_id: attempt_id,
-                receipt_path: receipt.empty? ? nil : receipt
-              )
-
-              emit_json(result.projection)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/start.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Bind an immutable attempt to an assignment step/subtree.
-          #
-          # Identity is derived from the execution boundary; a repeated
-          # identical start returns the active attempt, and a conflicting
-          # binding fails without launching a second writer.
-          class Start < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Start a scoped attempt for an assignment step"
-
-            option :assignment, desc: "Assignment ID"
-            option :step, desc: "Step or subtree scope (e.g. 010 or 010.01)"
-            option :project, desc: "Project ID the attempt executes in"
-
-            def call(**options)
-              usage = "start --assignment ID --step STEP --project ID"
-              assignment = require_option(options, :assignment, usage)
-              step = require_option(options, :step, usage)
-              project = require_option(options, :project, usage)
-
-              attempt = build_coordinator.start(
-                assignment_id: assignment,
-                step: step,
-                project_id: project
-              )
-
-              emit_json(attempt.projection)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/attempt/status.rb

@@ -1,54 +0,0 @@
-# frozen_string_literal: true
-
-require "json"
-require_relative "base"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Attempt
-          # Show attempt state, binding facts, and evidence references.
-          # JSON output carries only state, binding, references, and digests
-          # — never credentials or receipt bytes.
-          class Status < Ace::Support::Cli::Command
-            include Ace::Support::Cli::Base
-            include Attempt::Base
-
-            desc "Show attempt status for an assignment"
-
-            option :assignment, desc: "Assignment ID"
-            option :format, desc: "Output format (json, text)", default: "json"
-
-            def call(**options)
-              assignment = require_option(options, :assignment, "status --assignment ID --format json")
-              projection = build_coordinator.status(assignment)
-
-              if options[:format] == "text"
-                print_text(assignment, projection)
-              else
-                emit_json(projection || {"attempt" => nil})
-              end
-            end
-
-            private
-
-            def print_text(assignment, projection)
-              return puts "No attempts recorded for #{assignment}" if projection.nil?
-
-              puts "Attempt: #{projection['attempt_id']} #{projection['state']} (#{projection['scope']})"
-              puts "Recovery: #{projection['recovery_mode']}"
-              puts "Base head: #{projection['base_head']}"
-              puts "Candidate head: #{projection['candidate_head'] || 'unpinned'}"
-              puts "Evidence ref: #{projection['evidence_git_ref'] || 'local-only'}"
-              puts "Journal commit: #{projection['journal_commit'] || 'none'}"
-              return unless projection["unresolved_effects"].any?
-
-              puts "Unresolved effects: #{projection['unresolved_effects'].join(', ')}"
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/inbox_context_principal.rb

@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class InboxContextPrincipal < Ace::Support::Cli::Command
-            desc "Classify the actual caller through every retained protected owner"
-
-            def call(**options)
-              raise ArgumentError, "fixed inbox context options differ" unless options.empty?
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.inbox_principal())
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/ace/assign/cli/commands/authority/inbox_context_selection.rb

@@ -1,28 +0,0 @@
-# frozen_string_literal: true
-require_relative "../../../authority/prepared_task_context"
-
-module Ace
-  module Assign
-    module CLI
-      module Commands
-        module Authority
-          class InboxContextSelection < Ace::Support::Cli::Command
-            desc "Read the fixed installed inbox context selection"
-            option :project, required: true, desc: "Installed project ID"
-            option :mapping, required: true, desc: "Installed mapping ID"
-            option :inbox_context, required: true, desc: "Installed inbox context ID"
-
-            def call(**options)
-              raise ArgumentError, "fixed inbox context options differ" unless options.keys.sort == %i[inbox_context mapping project]
-              consumer = Ace::Assign::Authority::PreparedTaskContext.new(context: @protected_assignment_context)
-              $stdout.write(consumer.inbox_selection(**options))
-              0
-            rescue ArgumentError, Ace::Runtime::Error, Ace::Assign::Error => error
-              raise Ace::Support::Cli::Error, error.message
-            end
-          end
-        end
-      end
-    end
-  end
-end